The compliance.* family (3 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Createcompliance.exception.create
| Property | Value |
|---|---|
| Capability | other.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Member |
| Availability | On demand (MCP tier 2) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
Matter-scoped; fence matter in workspace. NOT the AI-Act compliance.write (different concern). The FE entity-edge mirror stays post-dispatch.
Call POST /v/compliance.exception.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool compliance.exception.create.
Deletecompliance.exception.delete
| Property | Value |
|---|---|
| Capability | other.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Member |
| Availability | On demand (MCP tier 2) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
FE unmirror stays post-dispatch.
Call POST /v/compliance.exception.delete with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool compliance.exception.delete.
Updatecompliance.exception.update
| Property | Value |
|---|---|
| Capability | other.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Member |
| Availability | On demand (MCP tier 2) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
Status machine sets/clears resolved_at + resolved_by_id (RESOLVED|WAIVED set; others clear). RLS fence workspace_id.
Call POST /v/compliance.exception.update with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool compliance.exception.update.